Alternative to passing variable info through URLs

Question

I am writing a php/mysql app that uses a few different tables.

Table 1 stores user information (name email etc), Table 2 stores that users widgets, and Table 3 stores those individual widgets' configuration.

The way im doing this now, is Table 1 has an auto increment key that i use to idenfity that specific user. When they access table 2, it creates a row that contains that tables own key ID, as well as a "uid", which is the key id, of that specific user from table 1. When the user wants to set settings for their widgets, in table 3, it stores what i call a "cxid", or config xid, which is the unique widget id from table 2.

The goal of this is to limit what widgets are seen by what users, and the config is used for configuration purposes obviously.

Problem is, that when im calling up an individuals widgets, it passes the uid in the URL. This is obviously a security issue as you can change that and view other people's widgets. But i dont even want anyone to know how this is being done. Is there any way of passing variables between scripts not using URL, but also not using forms?

Answer 1

Yep, you can use sessions.

Basically, you store all the necessary information about the user to $_SESSION, and retrieve it on each page load.

For instance, on the first page load:

session_start();
$_SESSION['uid'] = 123;

By default, the user would receive a cookie identifying the session, but containing no other information.

On the second page load, you could call:

session_start();
$x = $_SESSION['uid'];
//$x is now 123
//run a query here!

session_start() will read the user's cookie, find the session information (by default stored in a temporary file location) and fill $_SESSION with the information you stored last time you saw them.

Answer 2

It's possible to pass information around between your PHP pages using sessions, but the only way to get the information from the user (ie. which widget/cxid they want to view) is via a form post or the URL, the way you're doing it now.

You really need to do proper checking before displaying the widget the user has asked for.

First, store the userID in a session as zombat has already written.

Then you can do something like:

$result = mysql_query("SELECT cxid, uid FROM table2 WHERE cxid = '42'");
$row = mysql_fetch_row($result);    
if ($_SESSION['uid'] == $row['uid'])
{
    // display widget info
}
else
{
    echo 'Sorry you can only view your own widgets!';
}